1. Field of the Invention
The present invention relates generally to a security countermeasure technique in a computer network, and more particularly to a system and a method allowing protection of resources on an internal network against attacks from external networks.
2. Description of the Related Art
As defense techniques against attacks from external networks, the following approaches have been proposed: (1) firewall; (2) intrusion detection system; and (3) decoy (or honeypot) system.
An example of the firewall is disclosed in Japanese Patent Application Unexamined Pub. No. HE-44642 (hereafter referred to as Patent Document 1). According to the Patent Document 1, a firewall is installed at an interface between an external IP network and an internal Ethernet. The firewall determines whether a packet to be inspected should pass through from the external network to the internal network. Specifically, the firewall is provided with a packet filter. The packet filter determines whether a packet is allowed to pass through according to a predetermined rule, by looking at the type of protocol (such as TCP, UDP, HTTP), the contents of a payload as well as the header information of the packet (such as a source address and a destination address). Setting an appropriate rule can block the entrance of unauthorized packets containing worms into a Web server open to general external networks. See paragraph numbers 0029-0030 and FIG. 5 of the Patent Document 1.
An example of the intrusion detection system is disclosed in Japanese Patent Application Unexamined Pub. No. 2001-350678 (hereafter called Patent Document 2). This conventional intrusion detection system is provided with an unauthorized-intrusion determination rule executing section and unauthorized-intrusion determination rules for respective ones of applications such as WWW server and MAIL server. First, from a source IP address or a destination IP address of a packet flowing on an internal network, an IP address table obtaining section determines which application is currently running on the server having either of the IP addresses. Next, in the unauthorized-intrusion determination rule executing section, the unauthorized-intrusion determination rule for the determined application is executed to determine whether the packet is unauthorized or not. By processing as above, more accurate intrusion detection depending on the application can be enabled. See paragraph numbers 0062-0084 and FIG. 1 of the Patent Document 2.
A first example of the decoy system is disclosed in Japanese Patent Application Unexamined Pub. No. 2000-261483 (hereafter called Patent Document 3). This conventional decoy unit is provided with a traffic monitoring device, attack patterns and a disguised server on an internal network structured under a router 10. First, in the traffic monitoring device, packets flowing on the internal network are monitored and an attack pattern matching a specific attack pattern is detected as an unauthorized packet, then, its identification information (including the source IP address and the destination IP address) is notified to the router. Next, in the router, as to the subsequent packets from an external network, the packets having identification information coinciding with that of the detected packet are all transferred to the disguised server. The disguised server mimicking a regular server on the internal network interprets appropriately the transferred packets and creates counterfeit response packets. Thereafter the disguised server transmits the counterfeit response packets toward the host having transmitted the unauthorized packet before. By processing as above, it is possible to cause an attacker present on the external network to keep on attacking without adversely influencing the internal network, and to clarify the identity of the attacker by tracing back the packets. See paragraph numbers 0024-0030 and FIG. 1 of the Patent Document 3.
A second example of the decoy system is disclosed in Japanese Patent Application Unexamined Pub. No. 2002-7234 (hereafter called Patent Document 4). This conventional decoy unit is provided with a fraud detecting server and a decoy server as a so-called gateway at the interface between an internal network and an external network (Internet). The fraud detecting server monitors packets flowing from external networks to the internal network, and determines whether a packet is unauthorized or not by, for example, executing a predetermined pattern matching process to the payloads of receiving packets. A packet having been determined to be unauthorized is transferred to the decoy server or to an information processing server on the internal network after being added with a specific mark. The information processing server is previously provided with a fraud avoiding processing section. In the case where an unauthorized packet having the specific mark is transferred to the information processing server, the information processing server further transfers it to the decoy server. In either way, the unauthorized packet detected at the fraud detecting server finally reaches the decoy server. Then, the decoy server creates a counterfeit response packet and transmits it toward the source host of the unauthorized packet. By processing as above, all the packets determined to be unauthorized can be shut up on the decoy server. See paragraph numbers 0036-0040 and FIGS. 1 and 2 of the Patent Document 4.
A third example of the decoy system is described in Japanese Patent Application Unexamined Pub. No. H09-224053 (hereafter called Patent Document 5). This conventional decoy unit is provided with a screening system and an agent network at the interface between a public network (Internet) and a private network (intra network). The screening system executes a filtering process for packets arrived from each network connected with the screening system itself according to screening criteria based on information described in the headers of the packets, incoming packet history etc. However, one of the characteristics of the communication interface of the screening system is that it does not have any IP address and it can hide itself from tracing it back using Traceroute. As another characteristic, it can change the route of an arriving packet being directed to the private network, to the agent network. Zero (0) or more agent host is provided on the agent network and it can act as an agent of a host on the private network. By processing as above, a private network can be protected against attacks from a public network. See paragraph numbers 0037-0043, 0066-0067 and FIG. 6 of the Patent Document 5.
However, the above conventional techniques have problems listed below.
A first problem is that attacks cannot be effectively detected or defended against when a communication path encryption technique such as SSL (Secure Socket Layer) and IPSec (that has obtained RFC2401) is used between an attack-source host on an external network and a server on an internal network. The reason is that encrypted data (such as in payload) necessary for detecting attacks can not be referred to.
A second problem is that there are some packets overlooked by an inspection or the speediness of a network is lost since the performance of an attack detecting section cannot catch up completely with the speedup of networks in recent years. In order to improve the accuracy of sensing attacks, more various or more complicated determination rules are needed. However, the number of packets to be inspected is drastically increasing due to the speedup of networks.
In the intrusion detection systems described in Patent Document 2 and Patent Document 3 and in the first example of a decoy unit, at least one unauthorized packet can reach the server to be protected on an internal network. The reason is that the packets checked by an attack detecting section are just the copies of the packets and therefore the distribution of the packets on the internal network can not be blocked even when the copied packets have been determined as unauthorized.
Furthermore, in the third example of a decoy unit described in Patent Document 5, conditions and methods for changing the route of a packet incoming from the Internet to a substitute network are not discussed. Therefore, it is not possible to distribute packets correctly, permitting normal accesses to be guided to the substitute network and anomalous accesses to be guided to the internal network.
A third problem is that it is difficult to improve the accuracy of detecting attacks. The general form of operating a server is a remote maintenance work and the work includes modification of data in the server and updating of the system. Therefore, an intrusion detection system often mistakenly detects this maintenance work as attacks.
As is known with Web applications, various application programs such as database operation as a subsystem of a server are often run and attacks causing unauthorized operation taking advantage of such vulnerability of the subsystem are often seen. An intrusion detection system is provided with attack patterns well known commonly against servers or their subsystems as its knowledge. However, there is a risk of receiving unknown attacks in the case where there is a subsystem created specifically for a site or where configuration of a server or a subsystem is not complete though the server or the subsystem is a commonly-used one.
A fourth problem is as follows. In a server system provided with subsystems such as databases and plug-in modules, in which a specific access procedure is defined in a communication protocol between the server system and a client (that is, in the case of a stateful protocol), the client/server communication fails at both of the decoy server and the regular server when using such a method that only suspicious accesses are lured into a server which is not a regular server, such as a decoy server. Especially when an access has been mistakenly lured into the decoy server, a server failure will occur since processes to be executed on the regular server are not executed thereon.